CrowdStrike says a financially motivated threat actor used an open-source agentic penetration-testing tool called ARTEX, together with several AI models, to breach South Korean financial organisations. The research, published on 7 October 2026, follows reports of AI-linked attacks on the country’s financial sector.
The activity ran from late September to early October 2026 and led to exfiltrated data, according to CrowdStrike Intelligence. The firm has not tied it to a named adversary. It assesses with moderate confidence that the actor is Chinese-speaking, based on the use of ARTEX, a tool developed in China, and Chinese-language prompts found in the attacker’s files.
How the ARTEX attacks were run
CrowdStrike analysed open directories on attacker-controlled servers. They held Claude Code session histories, ARTEX configuration files and Claude memory files, which gave researchers a direct look at how the operation was built. The setup used two servers: a Hong Kong-based address as the main infrastructure, and a second address hosting the ARTEX instance believed to have run the Korean attacks.
ARTEX used DeepSeek v4.1-flash as its main language model. The actor added GLM-5.3 and Grok 4.6 for extra Claude Code sessions and routed traffic through nine proxy addresses. The session logs also show the actor asking Claude where Korean data breach information is typically sold and for help finding Korean Telegram data-sale groups.
What was breached in South Korea
Industry reports cited by CrowdStrike say several South Korean financial organisations suffered data breaches from late September. At one bank, the attacker reportedly got into a loan progress inquiry service used by financial brokers. At another, the target was an employee mobile work-support system. The number of affected organisations has not been confirmed.
Adam Meyers, CrowdStrike’s Head of Intelligence, said ARTEX “shows how adversaries are operationalizing agentic AI to move faster and conduct multiple intrusions in a short period.” CrowdStrike expects attackers to keep experimenting with AI tooling to speed up their operations.
